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.d<20000831 and ((packets adj2 filter$3) 
rewall) and (713/$.ccls. 705/$.ccls. 
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adaptive 
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709/$.ccls. 380/$.ccls. 370/$.ccls. ) and 
adaptable 

@ad<20000831 and ((packets adj2 filter$3) 
firewall) and (713/$.ccls. 705/$.ccls. 
709/$.ccls. 380/$.ccls. 370/$.ccls. ) and 
abstract near (filter policy rule) ) 
lad<20000831 and ((packets adj2 filter$3) 
'firewall) and (713/$.ccls. 705/$.ccls. 
709/$.ccls. 380/$.ccls. 370/$.ccls. ) and 
(refin$3 near (filter policy rule) ) 
@ad<20000831 and ((packets adj2 filter$3) 
firewall) and (713/$.ccls. 705/$.ccls. 
709/$.ccls. 380/$.ccls. 370/$.ccls. ) and 
(refin$3 same (filter policy rule)) 
i(@ad<20000831 and ((packets adj2 
filter$3) firewall) and (713/$. eels . 
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370/$. eels . ) and (refin$3 same (filter 
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(refin$3 same (adapt$3 dynamic)) 
@ad<20000831 and (priority same { (prior 
past previous) adj2 {attack$3 intrud$3 
intrusion))) and (analyz$3 analysis) 

@ad<20000831 and (priority same ( (prior 
past previous) adj2 (attack$3 intrud$3 
intrusion) ) ) and (priority) 

(aad<20000831 and (priority same ((prior 
past previous) adj2 (log histor???) ) ) 



iad<20000831 and ( {analy2$3 analysis) 

same ({prior past previous) adj2 (log 
^histor???) ) ) 
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same { (prior past previous) adj2 (log 

histor???))) and (intrusion intrud$3 

attack$3 hack$3) 
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Google 

flow-based packet filtering 

flow-based filtering 

flow-based analysis network 

"flow classification" ("packet filter" OR firewall) 

analyze packets fi*om ("known attacker" OR "known attacks" OR "previous intruder" 
"previous intrusion attempt") 

firewall refine policy 



ACM 

+flow +filter classify classification classifies classified 

H-flow +filter +packet classify classification classifies classified 

+"flow classification" "packet filter" firewall 



IEEE 

(flow <or> flows) <and> (filter <or> filtering <or> filters <or> filtered) <and> packet 
<and> (classify <or> classification <or> classifies <or> classified) 

("packet filter" <or> firewall) <and> "flow classification" 
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